scapy.fields module

Fields: basic data structures that make up parts of packets.

class scapy.fields.ActionField(fld, action_method, **kargs)

Bases: object

any2i(pkt, val)
class scapy.fields.BCDFloatField(name, default, fmt='H')

Bases: scapy.fields.Field

i2m(pkt, x)

Convert internal value to machine value

m2i(pkt, x)

Convert machine value to internal value

class scapy.fields.BitEnumField(name, default, size, enum)

Bases: scapy.fields.BitField, scapy.fields._EnumField

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

i2repr(pkt, x)

Convert internal value to a nice representation

i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.BitExtendedField(name, default, extension_bit)

Bases: scapy.fields.Field

Bit Extended Field

This type of field has a variable number of bytes. Each byte is defined as follows: - 7 bits of data - 1 bit an an extension bit:

  • 0 means it is last byte of the field (“stopping bit”)
  • 1 means there is another byte after this one (“forwarding bit”)

To get the actual data, it is necessary to hop the binary data byte per byte and to check the extension bit until 0

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

extended2str(x)
extension_bit
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2m(pkt, x)

Convert internal value to machine value

m2i(pkt, x)

Convert machine value to internal value

prepare_byte(x)
str2extended(x='')
class scapy.fields.BitField(name, default, size)

Bases: scapy.fields.Field

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2len(pkt, x)

Convert internal value to a length usable by a FieldLenField

randval()

Return a volatile object whose value is both random and suitable for this field

rev
reverse(val)
size
class scapy.fields.BitFieldLenField(name, default, size, length_of=None, count_of=None, adjust=<function BitFieldLenField.<lambda>>)

Bases: scapy.fields.BitField

adjust
count_of
i2m(pkt, x)

Convert internal value to machine value

length_of
class scapy.fields.BitMultiEnumField(name, default, size, enum, depends_on)

Bases: scapy.fields.BitField, scapy.fields._MultiEnumField

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

depends_on
i2repr(pkt, x)

Convert internal value to a nice representation

i2s
i2s_cb
i2s_multi
s2i
s2i_all
s2i_cb
s2i_multi
class scapy.fields.BoundStrLenField(name, default, minlen=0, maxlen=255, fld=None, length_from=None)

Bases: scapy.fields.StrLenField

maxlen
minlen
randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.ByteEnumField(name, default, enum)

Bases: scapy.fields.EnumField

class scapy.fields.ByteEnumKeysField(name, default, enum)

Bases: scapy.fields.ByteEnumField

ByteEnumField that picks valid values when fuzzed.

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.ByteField(name, default)

Bases: scapy.fields.Field

class scapy.fields.CharEnumField(name, default, enum, fmt='1s')

Bases: scapy.fields.EnumField

any2i_one(pkt, x)
class scapy.fields.ConditionalField(fld, cond)

Bases: object

addfield(pkt, s, val)
cond
fld
getfield(pkt, s)
class scapy.fields.DestField(name, default)

Bases: scapy.fields.Field

classmethod bind_addr(layer, addr, **condition)
defaultdst
dst_from_pkt(pkt)
class scapy.fields.DestIP6Field(name, default)

Bases: scapy.fields.IP6Field, scapy.fields.DestField

bindings = {<class 'scapy.layers.inet.UDP'>: [('ff02::fb', {'dport': 5353}), ('ff02::66', {'dport': 2029})], <class 'scapy.contrib.ospf.OSPFv3_Hdr'>: [('ff02::5', {})]}
i2h(pkt, x)

Convert internal value to human value

i2m(pkt, x)

Convert internal value to machine value

class scapy.fields.Emph(fld)

Bases: object

Empathize sub-layer for display

fld
class scapy.fields.EnumField(name, default, enum, fmt='H')

Bases: scapy.fields._EnumField

i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.FCSField(name, default, fmt='H')

Bases: scapy.fields.Field

Special Field that gets its value from the end of the packet (Note: not layer, but packet).

Mostly used for FCS

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.Field(name, default, fmt='H')

Bases: object

For more information on how this work, please refer to http://www.secdev.org/projects/scapy/files/scapydoc.pdf chapter Adding a New Field

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

copy()
default
do_copy(x)
fmt
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

h2i(pkt, x)

Convert human value to internal value

holds_packets = 0
i2count(pkt, x)

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2h(pkt, x)

Convert internal value to human value

i2len(pkt, x)

Convert internal value to a length usable by a FieldLenField

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

islist = 0
ismutable = False
m2i(pkt, x)

Convert machine value to internal value

name
owners
randval()

Return a volatile object whose value is both random and suitable for this field

register_owner(cls)
sz
exception scapy.fields.FieldAttributeException

Bases: scapy.error.Scapy_Exception

class scapy.fields.FieldLenField(name, default, length_of=None, fmt='H', count_of=None, adjust=<function FieldLenField.<lambda>>, fld=None)

Bases: scapy.fields.Field

adjust
count_of
i2m(pkt, x)

Convert internal value to machine value

length_of
class scapy.fields.FieldListField(name, default, field, length_from=None, count_from=None)

Bases: scapy.fields.Field

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

count_from
field
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2count(pkt, val)

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2len(pkt, val)

Convert internal value to a length usable by a FieldLenField

i2m(pkt, val)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

islist = 1
length_from
exception scapy.fields.FieldValueRangeException

Bases: scapy.error.Scapy_Exception

class scapy.fields.FixedPointField(name, default, size, frac_bits=16)

Bases: scapy.fields.BitField

any2i(pkt, val)

Try to understand the most input values possible and make an internal value from them

frac_bits
i2h(pkt, val)

Convert internal value to human value

i2repr(pkt, val)

Convert internal value to a nice representation

class scapy.fields.FlagValue(value, names)

Bases: object

copy()
flagrepr()
multi
names
value
class scapy.fields.FlagValueIter(flagvalue)

Bases: object

next()
slots = ['flagvalue', 'cursor']
class scapy.fields.FlagsField(name, default, size, names)

Bases: scapy.fields.BitField

Handle Flag type field

Make sure all your flags have a label

Example

>>> from scapy.packet import Packet
>>> class FlagsTest(Packet):
        fields_desc = [FlagsField("flags", 0, 8, ["f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7"])]  # noqa: E501
>>> FlagsTest(flags=9).show2()
###[ FlagsTest ]###
  flags     = f0+f3
>>> FlagsTest(flags=0).show2().strip()
###[ FlagsTest ]###
  flags     =
Parameters:
  • name – field’s name
  • default – default value for the field
  • size – number of bits in the field
  • names – (list or dict) label for each flag, Least Significant Bit tag’s name is written first # noqa: E501
any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

i2h(pkt, x)

Convert internal value to human value

i2repr(pkt, x)

Convert internal value to a nice representation

ismutable = True
m2i(pkt, x)

Convert machine value to internal value

multi
names
class scapy.fields.IEEEDoubleField(name, default)

Bases: scapy.fields.Field

class scapy.fields.IEEEFloatField(name, default)

Bases: scapy.fields.Field

class scapy.fields.IP6Field(name, default)

Bases: scapy.fields.Field

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

h2i(pkt, x)

Convert human value to internal value

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

m2i(pkt, x)

Convert machine value to internal value

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.IP6PrefixField(name, default, wordbytes=1, length_from=None)

Bases: scapy.fields._IPPrefixFieldBase

class scapy.fields.IPField(name, default)

Bases: scapy.fields.Field

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

h2i(pkt, x)

Convert human value to internal value

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

m2i(pkt, x)

Convert machine value to internal value

randval()

Return a volatile object whose value is both random and suitable for this field

resolve(x)
slots = []
class scapy.fields.IPPrefixField(name, default, wordbytes=1, length_from=None)

Bases: scapy.fields._IPPrefixFieldBase

class scapy.fields.IntEnumField(name, default, enum)

Bases: scapy.fields.EnumField

class scapy.fields.IntEnumKeysField(name, default, enum)

Bases: scapy.fields.IntEnumField

IntEnumField that picks valid values when fuzzed.

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.IntField(name, default)

Bases: scapy.fields.Field

class scapy.fields.LEFieldLenField(name, default, length_of=None, fmt='<H', count_of=None, adjust=<function LEFieldLenField.<lambda>>, fld=None)

Bases: scapy.fields.FieldLenField

class scapy.fields.LEIntEnumField(name, default, enum)

Bases: scapy.fields.EnumField

class scapy.fields.LEIntField(name, default)

Bases: scapy.fields.Field

class scapy.fields.LELongField(name, default)

Bases: scapy.fields.LongField

class scapy.fields.LEShortEnumField(name, default, enum)

Bases: scapy.fields.EnumField

class scapy.fields.LEShortField(name, default)

Bases: scapy.fields.Field

class scapy.fields.LESignedIntField(name, default)

Bases: scapy.fields.Field

class scapy.fields.LESignedLongField(name, default)

Bases: scapy.fields.Field

class scapy.fields.LEThreeBytesField(name, default)

Bases: scapy.fields.ByteField

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

class scapy.fields.LEX3BytesField(name, default)

Bases: scapy.fields.LEThreeBytesField, scapy.fields.XByteField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.LSBExtendedField(name, default)

Bases: scapy.fields.BitExtendedField

class scapy.fields.LenField(name, default, fmt='H', adjust=<function LenField.<lambda>>)

Bases: scapy.fields.Field

adjust
i2m(pkt, x)

Convert internal value to machine value

class scapy.fields.LongField(name, default)

Bases: scapy.fields.Field

class scapy.fields.MACField(name, default)

Bases: scapy.fields.Field

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

m2i(pkt, x)

Convert machine value to internal value

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.MSBExtendedField(name, default)

Bases: scapy.fields.BitExtendedField

class scapy.fields.MultiEnumField(name, default, enum, depends_on, fmt='H')

Bases: scapy.fields._MultiEnumField, scapy.fields.EnumField

depends_on
i2s_multi
s2i_all
s2i_multi
scapy.fields.MultiFlagsEntry

alias of scapy.fields.MultiFlagEntry

class scapy.fields.MultiFlagsField(name, default, size, names, depends_on)

Bases: scapy.fields.BitField

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

depends_on
i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

m2i(pkt, x)

Convert machine value to internal value

multi
names
class scapy.fields.MultipleTypeField(flds, dflt)

Bases: object

MultipleTypeField are used for fields that can be implemented by various Field subclasses, depending on conditions on the packet.

It is initialized with flds and dflt.

dflt is the default field type, to be used when none of the conditions matched the current packet.

flds is a list of tuples (fld, cond), where fld if a field type, and cond a “condition” to determine if fld is the field type that should be used.

cond is either:

  • a callable cond_pkt that accepts one argument (the packet) and returns True if fld should be used, False otherwise.
  • a tuple (cond_pkt, cond_pkt_val), where cond_pkt is the same as in the previous case and cond_pkt_val is a callable that accepts two arguments (the packet, and the value to be set) and returns True if fld should be used, False otherwise.

See scapy.layers.l2.ARP (type “help(ARP)” in Scapy) for an example of use.

addfield(pkt, s, val)
any2i(pkt, val)
dflt
flds
getfield(pkt, s)
h2i(pkt, val)
i2h(pkt, val)
i2len(pkt, val)
i2m(pkt, val)
i2repr(pkt, val)
name
register_owner(cls)
class scapy.fields.NetBIOSNameField(name, default, length=31)

Bases: scapy.fields.StrFixedLenField

i2m(pkt, x)

Convert internal value to machine value

m2i(pkt, x)

Convert machine value to internal value

class scapy.fields.OByteField(name, default)

Bases: scapy.fields.ByteField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.ObservableDict(*args, **kw)

Bases: dict

observe(observer)
update([E, ]**F) → None. Update D from dict/iterable E and F.

If E is present and has a .keys() method, then does: for k in E: D[k] = E[k] If E is present and lacks a .keys() method, then does: for k, v in E: D[k] = v In either case, this is followed by: for k in F: D[k] = F[k]

class scapy.fields.PacketField(name, default, cls, remain=0)

Bases: scapy.fields.StrField

cls
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

holds_packets = 1
i2m(pkt, i)

Convert internal value to machine value

m2i(pkt, m)

Convert machine value to internal value

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.PacketLenField(name, default, cls, length_from=None)

Bases: scapy.fields.PacketField

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

length_from
class scapy.fields.PacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketField

PacketListField represents a series of Packet instances that might occur right in the middle of another Packet # noqa: E501 field list. This field type may also be used to indicate that a series of Packet instances have a sibling semantic instead of # noqa: E501 a parent/child relationship (i.e. a stack of layers).

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

count_from
do_copy(x)
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2count(pkt, val)

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2len(pkt, val)

Convert internal value to a length usable by a FieldLenField

islist = 1
length_from
next_cls_cb
class scapy.fields.PadField(fld, align, padwith=None)

Bases: object

Add bytes after the proxified field so that it ends at the specified alignment from its beginning

addfield(pkt, s, val)
getfield(pkt, s)
padlen(flen)
class scapy.fields.ReversePadField(fld, align, padwith=None)

Bases: scapy.fields.PadField

Add bytes BEFORE the proxified field so that it starts at the specified alignment from its beginning

addfield(pkt, s, val)
getfield(pkt, s)
class scapy.fields.ScalingField(name, default, scaling=1, unit='', offset=0, ndigits=3, fmt='B')

Bases: scapy.fields.Field

Handle physical values which are scaled and/or offset for communication

Example

>>> from scapy.packet import Packet
>>> class ScalingFieldTest(Packet):
        fields_desc = [ScalingField('data', 0, scaling=0.1, offset=-1, unit='mV')]  # noqa: E501
>>> ScalingFieldTest(data=10).show2()
###[ ScalingFieldTest ]###
  data= 10.0 mV
>>> hexdump(ScalingFieldTest(data=10))
0000  6E                                               n
>>> hexdump(ScalingFieldTest(data=b"m"))
0000  6D                                               m
>>> ScalingFieldTest(data=b"m").show2()
###[ ScalingFieldTest ]###
  data= 9.9 mV

bytes(ScalingFieldTest(…)) will produce 0x6E in this example. 0x6E is 110 (decimal). This is calculated through the scaling factor and the offset. “data” was set to 10, which means, we want to transfer the physical value 10 mV. To calculate the value, which has to be sent on the bus, the offset has to subtracted and the scaling has to be applied by division through the scaling factor. bytes = (data - offset) / scaling bytes = ( 10 - (-1) ) / 0.1 bytes = 110 = 0x6E

If you want to force a certain internal value, you can assign a byte- string to the field (data=b”m”). If a string of a bytes object is given to the field, no internal value conversion will be applied

Parameters:
  • name – field’s name
  • default – default value for the field
  • scaling – scaling factor for the internal value conversion
  • unit – string for the unit representation of the internal value
  • offset – value to offset the internal value during conversion
  • ndigits – number of fractional digits for the internal conversion
  • fmt – struct.pack format used to parse and serialize the internal value from and to machine representation # noqa: E501
any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

m2i(pkt, x)

Convert machine value to internal value

ndigits
offset
randval()

Return a volatile object whose value is both random and suitable for this field

scaling
unit
class scapy.fields.SecondsIntField(name, default, use_msec=False, use_micro=False, use_nano=False)

Bases: scapy.fields.IntField

i2repr(pkt, x)

Convert internal value to a nice representation

use_micro
use_msec
use_nano
class scapy.fields.ShortEnumField(name, default, enum)

Bases: scapy.fields.EnumField

i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.ShortEnumKeysField(name, default, enum)

Bases: scapy.fields.ShortEnumField

ShortEnumField that picks valid values when fuzzed.

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.ShortField(name, default)

Bases: scapy.fields.Field

class scapy.fields.SignedByteField(name, default)

Bases: scapy.fields.Field

class scapy.fields.SignedIntEnumField(name, default, enum)

Bases: scapy.fields.EnumField

class scapy.fields.SignedIntField(name, default)

Bases: scapy.fields.Field

class scapy.fields.SignedLongField(name, default)

Bases: scapy.fields.Field

class scapy.fields.SignedShortField(name, default)

Bases: scapy.fields.Field

class scapy.fields.SourceIP6Field(name, dstname)

Bases: scapy.fields.IP6Field

dstname
i2h(pkt, x)

Convert internal value to human value

i2m(pkt, x)

Convert internal value to machine value

class scapy.fields.SourceIPField(name, dstname)

Bases: scapy.fields.IPField

dstname
i2h(pkt, x)

Convert internal value to human value

i2m(pkt, x)

Convert internal value to machine value

class scapy.fields.StrField(name, default, fmt='H', remain=0)

Bases: scapy.fields.Field

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2len(pkt, x)

Convert internal value to a length usable by a FieldLenField

i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

randval()

Return a volatile object whose value is both random and suitable for this field

remain
class scapy.fields.StrFixedLenEnumField(name, default, length=None, enum=None, length_from=None)

Bases: scapy.fields.StrFixedLenField

enum
i2repr(pkt, v)

Convert internal value to a nice representation

class scapy.fields.StrFixedLenField(name, default, length=None, length_from=None)

Bases: scapy.fields.StrField

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

i2repr(pkt, v)

Convert internal value to a nice representation

length_from
randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.StrLenField(name, default, fld=None, length_from=None, max_length=None)

Bases: scapy.fields.StrField

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

length_from
max_length
randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.StrLenFieldUtf16(name, default, fld=None, length_from=None, max_length=None)

Bases: scapy.fields.StrLenField

h2i(pkt, x)

Convert human value to internal value

i2h(pkt, x)

Convert internal value to human value

class scapy.fields.StrNullField(name, default, fmt='H', remain=0)

Bases: scapy.fields.StrField

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

randval()

Return a volatile object whose value is both random and suitable for this field

class scapy.fields.StrStopField(name, default, stop, additional=0)

Bases: scapy.fields.StrField

additional
getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

randval()

Return a volatile object whose value is both random and suitable for this field

stop
class scapy.fields.ThreeBytesField(name, default)

Bases: scapy.fields.ByteField

addfield(pkt, s, val)

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

getfield(pkt, s)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

class scapy.fields.UTCTimeField(name, default, use_msec=False, use_micro=False, use_nano=False, epoch=None, strf='%a, %d %b %Y %H:%M:%S %z')

Bases: scapy.fields.IntField

delta
epoch
i2m(pkt, x)

Convert internal value to machine value

i2repr(pkt, x)

Convert internal value to a nice representation

strf
use_micro
use_msec
use_nano
class scapy.fields.UUIDField(name, default, uuid_fmt=0)

Bases: scapy.fields.Field

Field for UUID storage, wrapping Python’s uuid.UUID type.

The internal storage format of this field is uuid.UUID from the Python standard library.

There are three formats (uuid_fmt) for this field type:

  • FORMAT_BE (default): the UUID is six fields in big-endian byte order, per RFC 4122.

    This format is used by DHCPv6 (RFC 6355) and most network protocols.

  • FORMAT_LE: the UUID is six fields, with time_low, time_mid and time_high_version in little-endian byte order. This doesn’t change the arrangement of the fields from RFC 4122.

    This format is used by Microsoft’s COM/OLE libraries.

  • FORMAT_REV: the UUID is a single 128-bit integer in little-endian byte order. This changes the arrangement of the fields.

    This format is used by Bluetooth Low Energy.

Note: You should use the constants here.

The “human encoding” of this field supports a number of different input formats, and wraps Python’s uuid.UUID library appropriately:

  • Given a bytearray, bytes or str of 16 bytes, this class decodes UUIDs in wire format.

  • Given a bytearray, bytes or str of other lengths, this delegates to uuid.UUID the Python standard library. This supports a number of different encoding options – see the Python standard library documentation for more details.

  • Given an int or long, presumed to be a 128-bit integer to pass to uuid.UUID.

  • Given a tuple:

    • Tuples of 11 integers are treated as having the last 6 integers forming the node field, and are merged before being passed as a tuple of 6 integers to uuid.UUID.

    • Otherwise, the tuple is passed as the fields parameter to uuid.UUID directly without modification.

      uuid.UUID expects a tuple of 6 integers.

Other types (such as uuid.UUID) are passed through.

FORMATS = (0, 1, 2)
FORMAT_BE = 0
FORMAT_LE = 1
FORMAT_REV = 2
any2i(pkt, x)

Try to understand the most input values possible and make an internal value from them

i2m(pkt, x)

Convert internal value to machine value

m2i(pkt, x)

Convert machine value to internal value

static randval()

Return a volatile object whose value is both random and suitable for this field

uuid_fmt
class scapy.fields.X3BytesField(name, default)

Bases: scapy.fields.ThreeBytesField, scapy.fields.XByteField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XBitField(name, default, size)

Bases: scapy.fields.BitField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XByteEnumField(name, default, enum)

Bases: scapy.fields.ByteEnumField

i2repr_one(pkt, x)
class scapy.fields.XByteField(name, default)

Bases: scapy.fields.ByteField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XIntField(name, default)

Bases: scapy.fields.IntField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XLEIntField(name, default)

Bases: scapy.fields.LEIntField, scapy.fields.XIntField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XLELongField(name, default)

Bases: scapy.fields.LELongField, scapy.fields.XLongField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XLEShortField(name, default)

Bases: scapy.fields.LEShortField, scapy.fields.XShortField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XLEStrLenField(name, default, fld=None, length_from=None, max_length=None)

Bases: scapy.fields.XStrLenField

i2m(pkt, x)

Convert internal value to machine value

m2i(pkt, x)

Convert machine value to internal value

class scapy.fields.XLongField(name, default)

Bases: scapy.fields.LongField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XShortEnumField(name, default, enum)

Bases: scapy.fields.ShortEnumField

i2repr_one(pkt, x)
class scapy.fields.XShortField(name, default)

Bases: scapy.fields.ShortField

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XStrField(name, default, fmt='H', remain=0)

Bases: scapy.fields.StrField

StrField which value is printed as hexadecimal.

i2repr(pkt, x)

Convert internal value to a nice representation

class scapy.fields.XStrFixedLenField(name, default, length=None, length_from=None)

Bases: scapy.fields._XStrLenField, scapy.fields.StrFixedLenField

StrFixedLenField which value is printed as hexadecimal.

class scapy.fields.XStrLenField(name, default, fld=None, length_from=None, max_length=None)

Bases: scapy.fields._XStrLenField, scapy.fields.StrLenField

StrLenField which value is printed as hexadecimal.

class scapy.fields.YesNoByteField(name, default, config=None, *args, **kargs)

Bases: scapy.fields.ByteField

A byte based flag field that shows representation of its number based on a given association

In its default configuration the following representation is generated:
x == 0 : ‘no’ x != 0 : ‘yes’

In more sophisticated use-cases (e.g. yes/no/invalid) one can use the config attribute to configure. Key-value, key-range and key-value-set associations that will be used to generate the values representation.

  • A range is given by a tuple (<first-val>, <last-value>) including the last value.
  • A single-value tuple is treated as scalar.
  • A list defines a set of (probably non consecutive) values that should be associated to a given key.

All values not associated with a key will be shown as number of type unsigned byte.

For instance:

config = {
    'no' : 0,
    'foo' : (1,22),
    'yes' : 23,
    'bar' : [24,25, 42, 48, 87, 253]
}

Generates the following representations:

x == 0 : 'no'
x == 15: 'foo'
x == 23: 'yes'
x == 42: 'bar'
x == 43: 43

Another example, using the config attribute one could also revert the stock-yes-no-behavior:

config = {
        'yes' : 0,
        'no' : (1,255)
}

Will generate the following value representation:

x == 0 : 'yes'
x != 0 : 'no'
eval_fn
i2repr(pkt, x)

Convert internal value to a nice representation